Samba PDC on Ubuntu 12.04 Using LDAP Backend - Part Two

Last time we have added the Samba schema to our LDAP-server which means our LDAP-server is ready and waiting the Samba data. Today is the day of the PDC itself.
(Ez a cikk magyarul is olvasható.)
We set low priority so the installer asks all questions.

sudo dpkg-reconfigure debconf

Installing the Samba package:

sudo apt-get install samba

During the installation we answer the questions (translated from Hungarian, so the original questions on your system may have different wording):

• Workgroup/Domain Name: ITTHON2012
• Use password encryption? Yes
• Do you alter smb.conf so the WINS settings will be obtained from DHCP? No
• How to start Samba? daemons
• Create samba password database (/var/lib/samba/passdb.tdb)? Yes

We see something like this in the last lines of the setup:

Importing account for nobody...ok
Importing account for a...ok
Importing account for localuser...ok
Importing account for jdoe...ok

If you do nozt want the local users in Samba, issue the following the command:

sudo smbpasswd -x localuser

Next job is to change the file /etc/samba/smb.conf:

[global]
   workgroup = ITTHON2012
   server string = %h PDC
   dns proxy = no

   log level = 2
   log file = /var/log/samba/log.%m
   max log size = 1000
   syslog = 0
   panic action = /usr/share/samba/panic-action %d

   security = user
   encrypt passwords = true

   passdb backend = ldapsam:ldap://localhost
   ldap suffix = dc=itthon,dc=cucc
   ldap admin dn = cn=admin,dc=itthon,dc=cucc
   ldap machine suffix = ou=Computers
   ldap user suffix = ou=People
   ldap group suffix = ou=Groups
   ldap idmap suffix = ou=Idmap
   ldap ssl = no

   ldap passwd sync = yes

   domain logons = yes

   add machine script = /usr/sbin/smbldap-useradd -w '%u'
   add user script = /usr/sbin/smbldap-useradd -m '%u'

[netlogon]
   comment = Network Logon Service
   path = /export/samba/netlogon
   guest ok = yes
   read only = yes

[share]
   comment = share
   read only = no
   locking = no
   path = /tmp
   guest ok = yes

Of course I do not want to tell anyone we have finished the editing of this file. For example the domain logons = yes implies roaming profiles and we have not defined the shares to store the profiles. No homeshares eighter. Printing is not mentioned. But for now it's okay. According to my experience these are far lesser problems to the two we are about to solve.

• The first thing to be able to add Windows workstations to the Samba domain
• The second is to enable user password changes from Windows

The next command tests the smb.conf file for errors:

sudo testparm

The output begins with a line like the next - do not get concerned:

rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)

We create the folders mentioned in the config file:

sudo mkdir -p /export/samba/netlogon

Restarting Samba:

sudo service smbd restart
sudo service nmbd restart

In the file /var/log/samba/log.smbd more and more lines appear with the following message: Connection to LDAP server failed for the 4 try! So we stop the server for now.

sudo service smbd stop
sudo service nmbd stop

All right, we have not told Samba the password it can connect to the LDAP server. So we tell the secret now.

sudo smbpasswd -W
Setting stored password for "cn=admin,dc=itthon,dc=cucc" in secrets.tdb

As you can see Samba asks for the password of the user specified in the file smb.conf. You also can see that it is stored in the default Samba3 location: secrets.tdb . We continue with the show:

sudo service smbd start
sudo service nmbd start

After the servers are started, we install a utility:

sudo apt-get install smbclient

We issue a command (in bold) and at the password prompt we press Enter, without specifing a password. If everithing is okay, the output looks like this:

smbclient -L localhost
Enter a's password: 
Anonymous login successful
Domain=[ITTHON2012] OS=[Unix] Server=[Samba 3.6.3]

    Sharename       Type      Comment
    ---------       ----      -------
    netlogon        Disk      Network Logon Service
    share           Disk      share
    IPC$            IPC       IPC Service (UBUSERVER)
Anonymous login successful
Domain=[ITTHON2012] OS=[Unix] Server=[Samba 3.6.3]

    Server               Comment
    ---------            -------
    UBUSERVER            ubuserver PDC

    Workgroup            Master
    ---------            -------
    ITTHON2012           UBUSERVER

You may have to wait a bit before the Master appears since if you've just started Samba it may have not won the elections for being the master browser.
At this point the following command has to run without errors. If you get an error meassage solve the problem before continuing.

sudo net getlocalsid

So the Samba server is operational but the LDAP directory is far too empty to be used.

We begin by doing everything mentioned in part called "Switch to the client computer" in this article on our server. For the URI you can use ldapi:/// provided your LDAP server and Samba PDC runs on the same machine. The aim is to have the commands getent passwd and getent group show the users and groups stored in the LDAP directory. When you are ready come back and read on.

From the next three commands the first will install the package smbldap-tools . We use it for two purposes:

• we populate the LDAP directory with the entries needed for the Samba server
• in the file smb.conf the options add machine script and add user script link to a command found in this package 

The second commands copies the file describing the connection between Samba and LDAP to the right place. The third command prevernts thw world from reading this file.

sudo apt-get install smbldap-tools
sudo cp /usr/share/doc/smbldap-tools/examples/smbldap_bind.conf /etc/smbldap-tools/smbldap_bind.conf
sudo chmod 600 /etc/smbldap-tools/smbldap_bind.conf

Let us see what to write in the file /etc/smbldap-tools/smbldap_bind.conf :

slaveDN="cn=admin,dc=itthon,dc=cucc"
slavePw="secret"
masterDN="cn=admin,dc=itthon,dc=cucc"
masterPw="secret"

After this we put another file to its palce - in this one we store the not-so-secret settings of smbldap-tools . (There used to be a file called configure.pl to create this file - many HOWTOs are mentioning it. It seems that it is not included in Precise Pangolin and to be honest I am happy with this fact. the config file is weel documented and should be enough.):

sudo sh -c "zcat /usr/share/doc/smbldap-tools/examples/smbldap.conf.gz > /etc/smbldap-tools/smbldap.conf"

You can make your smbldap.conf like this except for the SID line where you put the output of sudo net getlocalsid . (And I left the files cafile/clientcert/clientkey in place although there is neighter TLS nor SSL set up.)

slaveLDAP="localhost"
slavePort="389"
masterLDAP="localhost"
masterPort="389"
ldapTLS="0"
ldapSSL="0"
verify="require"
cafile="/etc/smbldap-tools/ca.pem"
clientcert="/etc/smbldap-tools/smbldap-tools.example.com.pem"
clientkey="/etc/smbldap-tools/smbldap-tools.example.com.key"
suffix="dc=itthon,dc=cucc"
usersdn="ou=People,${suffix}"
computersdn="ou=Computers,${suffix}"
groupsdn="ou=Groups,${suffix}"
idmapdn="ou=Idmap,${suffix}"
sambaUnixIdPooldn="sambaDomainName=${sambaDomain},${suffix}"
scope="sub"
# If set to "exop", use LDAPv3 Password Modify (RFC 3062) extended operation.
password_hash="SSHA"
password_crypt_salt_format="%s"
userLoginShell="/bin/bash"
userHome="/home/%U"
userHomeDirectoryMode="700"
userGecos="System User"
defaultUserGid="513"
defaultComputerGid="515"
skeletonDir="/etc/skel"
shadowAccount="1"
defaultMaxPasswordAge="100"
userSmbHome="\\UBUSERVER\%U"
userProfile="\\UBUSERVER\profiles\%U"
userHomeDrive="S:"
userScript="logon.cmd"

When ready with this file you might want to issue the command sudo smbldap-populate . This command will populate the LDAP with the entries needed for Samba 3. Do not issue that command, as the first user will get the UID 1000 and that is already in use. There are good chances you are logged on using that (man id). So you'd better:

sudo smbldap-populate -u 5000 -g 5000

In the terminal you will see lines like this: Use of qw(...) as parentheses is deprecated at /usr/share/perl5/smbldap_tools.pm line 1423, <DATA> line 522. Ignore the message for now, we are going to deal with it later. Sooner or later you will see:

Please provide a password for the domain root:
Use of qw(...) as parentheses is deprecated at /usr/share/perl5/smbldap_tools.pm line 1423, <DATA> line 522.
Changing UNIX and samba passwords for root
New password:

You can type in for example the LDAP admin password (secret). The smbldap-tools will add root to the Samba users list with the right of Domain Demigod. It is a pity we will never use it :)

Now for the case of qw. Search the line in question in the file mentioned above and replace

for my $sig_name qw(ALRM INT HUP QUIT TERM TSTP TTIN TTOU) {

with this (the prathenses in bold(?) are new):

for my $sig_name (qw(ALRM INT HUP QUIT TERM TSTP TTIN TTOU)) {

We add our first samba user (suser1):

sudo smbldap-useradd -a -m -P suser1

And we get a slap in the face:
Failed to execute: /usr/sbin/smbldap-passwd.cmd: No such file or directory at /usr/sbin/smbldap-useradd line 668.

So let's remove suser1 :

sudo smbldap-userdel suser1
sudo rm -r /home/suser1/

Let us remove the trouble too:

sudo ln -s /usr/sbin/smbldap-passwd /usr/sbin/smbldap-passwd.cmd

And finally we create suser1 once again:

sudo smbldap-useradd -a -m -P suser1

Let us logon fisrt to a client running Linux. If you get a password aged message, you want to read this. If you can logon with no errors, we can turn suser1 into a Samba Domain Admin. (Yes I do know the next line makes suser1 'Administrator' but that is okay.)

sudo smbldap-groupmod -m 'suser1' 'Administrators'

If you logon to a Windows system (I like to try things first on an XP but a Windows 7 will do as well after some changes) then:

• suser1 can add the Windows to the domain ITTHON2012,
• and after that we can log on to the domain (of course there will be crying due to the missing cebtral profile but we ignore that for now),
• and we can change our password.

There is still some work to do. Fist we have to take care of indexing the LDAP-attributes needed for Samba. The other is a bit more difficult:

• if we change the Samba password in Windows, the change will be propagated to Linux since in the file smb.conf we set the ldap passwd sync = yes and because of this the Samba server will update not only the sambaNTPassword attribute in the LDAP database but also the Linux (Unix) password stored in the attribute userPassword .
• but if we change our passowrd on a Linux client using for example the command passwd then the change is not propagated to Samba: onyl the userPassword is updated and the sambaNTPassword is not.

We are to help that.

  

Further reading:

zless /usr/share/doc/smbldap-tools/README.Debian.gz

http://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg1014660.html